如何在 firebase 函数中检查 Stripe webhook 签名

Question

Hi 👋🏻I'm trying to verify a Stripe signature in Firebase functions. But when i try stripe.webhooks.constructEvent it catches an error saying:

No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? https://github.com/stripe/stripe-node#webhook-signing No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? https://github.com/stripe/stripe-node#webhook-signing 😔

I've logged out the raw body, and it looks fine 🤖

<Buffer 7b 0a 20 20 22 69 64 22 3a 20 22 65 76 74 5f 31 46 72 6b 4d 73 41 55 73 34 77 79 52 42 49 73 63 6d 66 72 43 39 7a 37 22 2c 0a 20 20 22 6f 62 6a 65 63 ... >

Here is the relevant code:

  // A webhook called by stripe
  const sig = req.headers['stripe-signature']
  let event
  // 1. construct event and validate
  try {
    event = stripe.webhooks.constructEvent(req.rawBody, sig, functions.config().stripe.mytestkey)
    assert(event)
  } catch (err) {
    console.log(`Error when constructing Stripe event: ${err} - ${req.body}`)
    res.status(400).send({ error: `Stripe webhook error: ${err}` })
    return
  }

  // 2. Handle webhook
  res.status(200).send(`successfully handled webhook ${hook}`)
})

Any thoughts? 💭

Answer 1

Doing

let sig = req.get('stripe-signature');

instead of

const sig = req.headers['stripe-signature']

should do the trick.

According to the Express documentation :

req.get(field)

Returns the specified HTTP request header field (case-insensitive match).

Answer 2

Finally, I figured out I had to write req.rawBody.toString('utf8') . Source: https://github.com/stripe/stripe-node/issues/341